Cyber Essentials

Cyber Essentials password and MFA requirements in plain English (2026)

The password and MFA questions are where many small firms trip up on Cyber Essentials. The rules are shorter and more sensible than most people expect. This guide explains them in plain English, using the current version of the scheme.

Last updated:

Which version of Cyber Essentials applies to you?

The scheme is updated each April. The current rules are version 3.3, known as Danzell. According to IASME, they apply to assessment accounts created from late April 2026. If you opened your assessment account before then, you have six months to finish on the older question set.

The password rules themselves did not change much in 2026. What changed is how strictly MFA is marked, and that cloud services can no longer be kept out of scope. This guide follows the official requirements document from the NCSC. If you are new to the scheme, start with our Cyber Essentials beginner's guide.

What does Cyber Essentials say about MFA?

The requirement is short: use MFA where it is available, and authentication to cloud services must always use MFA.

Since April 2026, IASME marks this as an automatic fail. If a cloud service offers MFA and you have not turned it on, you fail the assessment, even if every other answer is perfect. This applies when MFA is free, included in your plan or a paid extra.

A cloud service, for this purpose, is anything you log into over the internet that stores or processes your business data. In practice that includes:

  • Microsoft 365 or Google Workspace
  • Accounting and payroll software, such as Xero, QuickBooks or Sage
  • CRM, HR and project tools
  • File sharing services, such as Dropbox
  • Business social media accounts, if they are run with a business email address

It covers normal staff accounts, not just admins. The scheme also says MFA should always protect admin accounts and anything reachable from the internet.

What counts as MFA?

The requirements list four kinds of second factor: a managed device, an app on a trusted device, a separate physical token, or a known trusted account. Passkeys and FIDO2 security keys are now recognised as MFA on their own.

SMS codes count. The NCSC says they are not the strongest option, but far better than nothing. Where a service offers an authenticator app, use that instead. Our guides to MFA in Microsoft 365 and authenticator apps for staff walk through the set-up.

If MFA uses a password as one of its factors, that password must be at least 8 characters, with no maximum length.

What are the Cyber Essentials password rules?

Where people still sign in with a password, the scheme asks for three things.

1. Stop password guessing

You need at least one of these:

  • MFA on the account
  • Throttling, so the wait between attempts gets longer after each wrong guess, with no more than 10 guesses in 5 minutes
  • Locking the device after no more than 10 wrong attempts

Most phones and laptops lock or slow down after failed PINs by default. Microsoft 365 also has a smart lockout feature for cloud sign-ins. Check your own settings rather than assuming.

2. Enforce password quality with a technical control

A written policy is not enough. A system setting must enforce one of these:

Ways to meet the Cyber Essentials password quality rule
OptionWhat it meansGood fit for
MFA on the accountThe second factor does the heavy liftingCloud services, email, admin accounts
12 character minimumAt least 12 characters, no maximum lengthLaptops and services without MFA
8 character minimum plus deny listAt least 8 characters, no maximum, and common passwords blocked automaticallySystems that already block weak passwords

Microsoft 365 already blocks common passwords through its banned password list. Even so, the simplest route for most small firms is MFA on every cloud account and a 12 character minimum on devices.

3. Help staff choose unique passwords

The scheme asks you to support people, not punish them. That means:

  • explaining why common passwords, pets' names and keyboard patterns are a bad idea
  • encouraging longer passwords made of at least three random words, as the NCSC suggests
  • giving people somewhere safe to store passwords, such as a password manager or a locked cabinet, with clear rules on using it
  • not forcing regular password changes
  • not forcing complexity rules, such as one capital, one number and one symbol

You also need a simple, known process for changing a password quickly if you think it has been compromised.

Which mistakes cause a fail?

These are the common ones to check before you submit:

  • One cloud service without MFA. Often a forgotten one: the domain registrar, the accounting app, or the company Facebook or LinkedIn admin login.
  • Leaving cloud services out of scope. Version 3.3 says they cannot be excluded.
  • A maximum password length. Some older systems cap passwords at 16 characters. That breaks the rule.
  • Forced 90 day changes still switched on from an old policy.
  • Shared logins. The scheme asks for unique credentials for each user. Our guide to sharing passwords securely covers how to give people their own access.
  • Old accounts left open. Accounts must be removed or disabled when people leave. See our staff leaver checklist.

How do you get ready, step by step?

1. List every cloud service

Go through bank statements and card bills for software subscriptions. Ask each team what they log into. Write down every service that holds business data.

2. Turn on MFA everywhere it is offered

Start with email, because it can reset everything else. In Microsoft 365, security defaults switch MFA on for everyone. Google Workspace lets you enforce 2-Step Verification. Then work down the list.

3. Set device password rules

Set a 12 character minimum, or MFA such as Windows Hello for Business, and a lockout after no more than 10 wrong attempts. Remove any maximum length and any forced expiry.

4. Give staff a password manager

This makes long, unique passwords easy and gives you one place to remove access when someone leaves. Turn on MFA for the password manager itself.

5. Write down your answers as you go

Note which setting meets each rule. It makes the questionnaire much quicker, and next year's renewal too.

Does a password manager help with Cyber Essentials?

Yes, but it is not required. The requirements name a password manager as one way to give staff usable, secure storage for passwords, and as a way to generate unique ones. It also helps you meet the leaver and unique-login rules.

Our guide to choosing a password manager for a small business compares the main options for UK firms. NordPass is one option for small teams. Its business plans include an admin panel and a password generator. Check which plan includes the features you need before you buy.

A password manager does not get you certified on its own. You still need the other four controls: firewalls, secure configuration, security updates and malware protection.

FAQ

Does Cyber Essentials require 12 character passwords?
Not always. A 12 character minimum is one of three options. The others are MFA on the account, or an 8 character minimum with automatic blocking of common passwords. Whichever you pick, there must be no maximum length.
Is MFA mandatory for Cyber Essentials?
For cloud services, yes, wherever the service offers it. Since the April 2026 update, not having MFA on a cloud service that supports it is an automatic fail, even if MFA is a paid extra. MFA is also expected on admin accounts and anything reachable from the internet.
Does Cyber Essentials make you change passwords every 90 days?
No. The requirements say you should not enforce regular password expiry. You should change a password promptly if you know or suspect it has been compromised.
Does SMS count as MFA for Cyber Essentials?
Yes. The requirements say SMS is not the strongest type of MFA but is much better than none. Use an authenticator app, a passkey or a security key where the service offers one.
Do we need a password manager to pass Cyber Essentials?
No. A password manager is listed as one way to give staff usable, secure storage for passwords, alongside a locked cabinet. It helps, but it is not required, and it does not give you the certificate on its own.

Official guidance

Sources we checked

Pages were checked on 10 November 2026.

Written for UK SME owners. More guides · How we make money